Base64

Base64 is an encoding that represents any sequence of bytes using 64 printable text characters, so binary data can travel through systems built for text such as email, JSON, URLs and HTTP headers. It is not encryption, and it makes data about a third larger.

How it works

Base64 reads the input three bytes (24 bits) at a time and splits those 24 bits into four groups of six. Each six-bit value, 0 to 63, is looked up in a 64-character alphabet:

Values	Characters
0–25	`A`–`Z`
26–51	`a`–`z`
52–61	`0`–`9`
62 and 63	`+` and `/`

The text Man is the bytes 01001101 01100001 01101110. Regrouped as 010011 010110 000101 101110, they are the values 19, 22, 5 and 46, which spell TWFu.

Padding and size

When the input length is not a multiple of three, the last group is short and = characters fill it out to four characters. One leftover byte gives == and two give =, so M becomes TQ== and Ma becomes TWE=.

Every three bytes become four characters, so the output length is 4 × ⌈n / 3⌉. Encoding 1,000 bytes gives 1,336 characters, an increase of about 33%.

Where it is used

Data URIs: data:image/png;base64,… embeds a small file directly in HTML or CSS.
Email attachments: MIME encodes binary attachments as Base64, wrapped at 76 characters per line.
HTTP Basic authentication: the Authorization header carries username:password as Base64.
JWTs use the URL-safe variant, Base64URL.
PEM files wrap certificates and keys in Base64 between BEGIN and END lines.
JSON and XML payloads that need to carry binary data.

Common pitfalls

Treating it as security. Base64 is reversible by anyone in an instant. A password or API key in Base64 is still readable, and HTTP Basic auth is only safe because the connection is encrypted.
Unicode in the browser. btoa() accepts only Latin-1 characters and throws on the rest, so convert text to UTF-8 bytes first.
Mixing variants. Standard Base64 and Base64URL differ in two characters and in padding, and a decoder for one can reject the other.
Stray whitespace and line breaks. Some tools wrap output at 64 or 76 characters, and strict decoders reject the newlines.
Assuming the result is text. Decoded Base64 may be an image, a compressed file or a key, which is why it can look like garbage.

Base64URL — Base64URL is a variant of Base64 that swaps the characters "+" and "/" for "-" and "_" and usually drops the "=" padding, so encoded bytes can sit safely inside URLs, filenames and JWTs. It is defined in RFC 4648, section 5.
JWT (JSON Web Token) — A JSON Web Token is a compact, URL-safe string that carries a set of claims as JSON, usually signed so the receiver can detect tampering. It is defined in RFC 7519 and is widely used for API and session authentication.
PEM (Privacy-Enhanced Mail) — PEM is a text format that wraps Base64-encoded binary data, most often certificates and keys, between "BEGIN" and "END" marker lines so it can be copied, emailed and stored as plain text. RFC 7468 describes how it is used today.